Loading zfs encryption keys at boot

automatic-zfs-volume-keys.yaml

- name: Install ZFS tools/utilities
  apt:
    name: "{{ item }}"
    state: present
  with_items:
    - zfsutils-linux

- name: Install tank encryption key
  copy:
    dest: /etc/zfs/tank.key
    owner: root
    group: root
    mode: 0600
    content: |
      $ANSIBLE_VAULT;1.1;AES256
      123456blahblah
      encryptedvaulttext
      goeshere123456

- name: Install zfs load-key service
  copy:
    dest: /etc/systemd/system/[email protected]
    mode: 0644
    owner: root
    group: root
    content: |
      [Unit]
      Description=Load ZFS keys
      DefaultDependencies=no
      Before=zfs-mount.service
      After=zfs-import.target
      Requires=zfs-import.target

      [Service]
      Type=oneshot
      RemainAfterExit=yes
      ExecStart=/sbin/zfs load-key %I

      [Install]
      WantedBy=zfs-mount.service

- name: Enable zfs load-key services
  systemd:
    name: "zfs-load-key@{{ item }}"
    enabled: yes
  with_items:
    - tank